CVE-2026-38093: Path Traversal
filepicker (aka flutterfilepicker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query() directly in file path construction without sanitization. A malicious Android app with a crafted ContentProvider can return a filename containing ../ sequences, causing the plugin to create arbitrary files and directories outside the intended cache directory within the victim app's internal storage. Existing files are not overwritten due to an existence check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
file_picker (flutter_file_picker)to a version that resolves this vulnerability.Fixed in 10.3.10
Event History
Frequently Asked Questions
Which applications are affected?
Flutter applications that use file_picker on Android are affected if they include a version through 10.3.10 and invoke the Android openFileStream() path.
What does an attacker need to exploit this issue?
An attacker needs a malicious Android app that exposes a crafted ContentProvider. The provider must return a DISPLAY_NAME containing ../ sequences when queried by the vulnerable plugin code.
Can this overwrite files already present in the victim app's storage?
No. The described implementation checks whether a target already exists, so existing files are not overwritten. It can still create arbitrary new files and directories outside the intended cache directory within the victim app's internal storage.
What can be done before updating the dependency?
Avoid using openFileStream() with content supplied by untrusted Android ContentProviders, because the vulnerable path constructs file paths directly from the provider-controlled DISPLAY_NAME.